ID Sequence Analysis for Intrusion Detection in the CAN bus using Long Short Term Memory Networks

Abstract

The number of computer controlled vehicles throughout the world is rising at a staggering speed. Even though this enhances the driving experience, it opens a new security hole in the automotive industry. To alleviate this issue, we are proposing an intrusion detection system (IDS) to the controller area network (CAN), which is the de facto communication standard of present-day vehicles. We implemented an IDS based on the analysis of ID sequences. The IDS uses a trained Long-Short Term Memory (LSTM) to predict an arbitration ID that will appear in the future by looking back to the last 20 packet arbitration IDs. The output from the LSTM network is a softmax probability of all the 42 arbitration IDs in our test car. The softmax probability is used in two approaches for IDS. In the first approach, a single arbitration ID is predicted by taking the class which has the highest softmax probability. This method only gave us an accuracy of 0.6. Applying this result in a real vehicle would give us a lot of false negatives, hence we devised a second approach that uses log loss as an anomaly signal. The evaluated log loss is compared with a predefined threshold to see if the result is in the anomaly boundary. Furthermore, We have tested our approach using insertion, drop and illegal ID attacks which greatly outperform the conventional method with practical F1 scores of 0.9, 0.84, and 1.0 respectively.

Intrusion Detection Method Using Bi-Directional GPT for in-Vehicle Controller Area Networks

“…For comparison with the performance of other existing methods, the GAN-based method proposed in [3] and the LSTM-based prediction method proposed in [6] were se- As expected, the AUC performance of the proposed method is improved compared to the other methods. In particular, compared to the unidirectional GPT model, the proposed model combining GPT networks in both the forward and backward directions can achieve higher performance with the same degree of complexity.…”

“…Reference [6] proposed a method of detecting attacks using a forward-direction prediction technique based on an LSTM network. Specifically, it predicts the log probability of the CAN ID appearing immediately after a given CAN ID sequence.…”

“…Specifically, an arbitrary electrical control unit (ECU) can broadcast a CAN data frame containing a CAN identifier (ID) and a message from any device connected to the bus [1]. As attacks against CAN bus communication have become more advanced and intelligent, increasingly sophisticated defense techniques against them have been proposed [2]- [6]. Existing methods detect the pattern changes caused by an attack after learning the normal pattern of a CAN ID sequence, which is composed of CAN IDs extracted only from CAN data frames.…”

Design of Anomaly Detection Functions for Controller Area Networks

“…Taylor, Leblanc, and Japkowicz [12] use Long Short-Term Memory (LSTM) networks to detect sequential anomalies in CAN data, however their approach results in higher than acceptable false positive rate. Desta, et al [13] propose an LSTM network to predict the next CAN arbitration ID and compare it with the actual arbitration ID, however their proposed scheme is vulnerable to replay attacks. A basic LSTM network was used to classify CAN frames as normal frames or attack frames in [14].…”

“…A number is assigned to each CAN variable and a letter is assigned to each operation. An example rule is 0 13 a which represents the correlation (a) between brake position (0) and fuel pressure (13). The above properties ensure that the graph has a minimum number of vertices and a minimum radius.…”